dsh-plugin-compat-check 0.1.6 → 0.1.7

package/kernel/lib/extract.mjs

@@ -3,6 +3,12 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { analyzeSources } from "./source-analysis.mjs";
+import {
+  readStaticFile,
+  readStaticDirectory,
+  inputError,
+  lowerInputLimits,
+} from "./static-input.mjs";
 import {
   collectPackageSources,
   clientEntry as declaredClientEntry,
@@ -14,12 +20,19 @@ const cmp = (a, b) =>
     : String(a ?? "") > String(b ?? "")
       ? 1
       : 0;
-const pkgJson = (dir) => {
+const pkgJson = (dir, maxBytes, check) => {
+  let readBytes = 0;
   try {
-    const p = JSON.parse(fs.readFileSync(join(dir, "package.json"), "utf8"));
-    return p && typeof p === "object" && !Array.isArray(p) ? p : null;
-  } catch {
-    return null;
+    const bytes = readStaticFile(join(dir, "package.json"), maxBytes, check);
+    readBytes = bytes.length;
+    const p = JSON.parse(bytes.toString("utf8"));
+    if (!p || typeof p !== "object" || Array.isArray(p))
+      throw new Error("Invalid package object");
+    return { meta: p, bytes: bytes.length };
+  } catch (error) {
+    if (error.code === "ENOENT" || error.code === "ENOTDIR") return {};
+    if (error.code === "STATIC_INVENTORY_BUDGET") throw error;
+    return { error, bytes: readBytes };
   }
 };
 const sortCalls = (calls) =>
@@ -45,7 +58,7 @@ function clientHalfDeliverable(pkgDir, j) {
       platform: "web",
       ok: false,
       declaredEntry: null,
-      why: '声明了 dsh.client 却没有 exports["./client"]',
+      why: '声明了 dsh.client，但 exports["./client"] 不是字符串或含字符串 default 的对象',
     };
   try {
     const root = fs.realpathSync(pkgDir),
@@ -96,14 +109,37 @@ export function extractWithProvenance(nm, options = {}) {
   // 找出「社区插件」：package.json 里有 dsh 清单、且非 @deepseek-ai 官方
   const inventoryDiagnostics = [];
   const targets = [];
-  for (const entry of fs.readdirSync(nm).sort()) {
+  const inventory = lowerInputLimits(
+    {
+      entries: 50000,
+      bytes: 32 * 1024 * 1024,
+      manifestBytes: 65536,
+      timeMs: 5000,
+    },
+    options.inventoryLimits,
+  );
+  let inventoryEntries = 0,
+    inventoryBytes = 0;
+  const started = Date.now();
+  const checkInventory = () => {
+    if (Date.now() - started > inventory.timeMs)
+      throw inputError("STATIC_INVENTORY_BUDGET", "插件清单超过时间预算");
+  };
+  const listInventory = (dir) => {
+    const names = readStaticDirectory(
+      dir,
+      inventory.entries - inventoryEntries,
+      checkInventory,
+    );
+    inventoryEntries += names.length;
+    return names;
+  };
+  for (const entry of listInventory(nm)) {
+    checkInventory();
     const names = entry.startsWith("@")
       ? (() => {
           try {
-            return fs
-              .readdirSync(join(nm, entry))
-              .sort()
-              .map((s) => join(entry, s));
+            return listInventory(join(nm, entry)).map((s) => join(entry, s));
           } catch (error) {
             throw new Error(
               `无法读取插件 scope ${entry}：${error.code || error.message}`,
@@ -112,12 +148,20 @@ export function extractWithProvenance(nm, options = {}) {
         })()
       : [entry];
     for (const base of names) {
+      checkInventory();
       const full = join(nm, base);
-      const j = pkgJson(full);
-      if (!j && fs.existsSync(join(full, "package.json")))
+      const metadata = pkgJson(
+        full,
+        Math.min(inventory.manifestBytes, inventory.bytes - inventoryBytes),
+        checkInventory,
+      );
+      inventoryBytes += metadata.bytes || 0;
+      const j = metadata.meta;
+      if (metadata.error)
         inventoryDiagnostics.push({
           kind: "invalid-package-metadata",
           file: base,
+          code: metadata.error.code || "STATIC_INPUT_INVALID",
         });
       if (
         !j ||

package/kernel/lib/finding-guidance.mjs

@@ -52,6 +52,12 @@ export function nextSteps(finding) {
         "在报告给出的源码位置核对服务读取及必需 inject 的作用域，并确认 absent 观测绑定同一 profile、DSH 版本与采样时间。",
         "核对该服务的实际提供者及 loader 状态，补充相关功能操作结果；服务缺失的推断影响不等于业务失败已实测。",
       ];
+    case "api-argument-invalid":
+    case "api-option-unsupported":
+      return [
+        "按源码位置核对选项类型、枚举、实际传值和精确目标版本，查阅 evidence 中固定源码及归档摘要；方法存在或能力守卫不证明参数有效。",
+        "在独立目标会话核验草稿保留、替换或追加；本项仅是静态参数风险，不证明业务失败，也不自动修改或提交草稿。",
+      ];
     case "host-method-missing":
       return [
         "在报告给出的文件与行号核对实际方法调用、Context 绑定及能力守卫，检查是否存在报告尚未识别的兜底。",

package/kernel/lib/finding-review-store.mjs

@@ -1,5 +1,6 @@
 /** Bounded manual-review sidecar storage. Never mutates reports or baseline state. */
 import fs from "node:fs/promises";
+import { acquireStateLock, stateDirectory } from "./state-lock.mjs";
 import { constants } from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -105,16 +106,13 @@ function storage(context, options) {
     `reviews.${context.targetKey}.json`,
   );
 }
-async function safeDirectory(dir, { create = false } = {}) {
-  if (create) await fs.mkdir(dir, { recursive: true, mode: 0o700 });
-  const stat = await fs.lstat(dir);
-  if (
-    !stat.isDirectory() ||
-    stat.isSymbolicLink() ||
-    (typeof process.getuid === "function" && stat.uid !== process.getuid())
-  )
-    throw fault("Unsafe review directory", "REVIEW_STORAGE");
-  if (create && stat.mode & 0o077) await fs.chmod(dir, 0o700);
+async function safeDirectory(dir, options = {}) {
+  try {
+    stateDirectory(dir, options);
+  } catch (error) {
+    if (error.code === "ENOENT") throw error;
+    throw fault(error.message, "REVIEW_STORAGE");
+  }
 }
 async function load(file) {
   try {
@@ -185,18 +183,11 @@ export async function saveReview(context, input, options = {}) {
   let lockHandle = null;
   try {
     try {
-      lockHandle = await fs.open(
-        lock,
-        constants.O_CREAT |
-          constants.O_EXCL |
-          constants.O_WRONLY |
-          constants.O_NOFOLLOW,
-        0o600,
-      );
+      lockHandle = acquireStateLock(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         throw fault(
-          `人工处置写入锁仍存在或上次保存已中断：${lock}。刷新不会清除此锁；确认没有保存任务后，仅清理该.lock及同目录遗留.reviews-*.tmp，保留原始reviews JSON。`,
+          `人工处置写入锁仍存在或上次保存已中断：${lock}。刷新不会清除此锁；使用对应源码仓库的 bin/recover-lock.mjs 检查并显式恢复已确认退出的持有者；保留原始 JSON 及临时文件。`,
           "REVIEW_BUSY",
         );
       throw error;
@@ -237,9 +228,6 @@ export async function saveReview(context, input, options = {}) {
     return combineReviews(context, records, { revision: next.revision });
   } finally {
     await fs.rm(temp, { force: true }).catch(() => {});
-    if (lockHandle) {
-      await lockHandle.close();
-      await fs.unlink(lock).catch(() => {});
-    }
+    lockHandle?.release();
   }
 }

package/kernel/lib/issue-report.mjs

@@ -1,13 +1,14 @@
 /** Shared CLI/panel share view. Never serialize raw inputs, logs, evidence or baseline. */
 import { TOOL_VERSION } from "./version.mjs";
 import { nextSteps } from "./finding-guidance.mjs";
+import { terminalText } from "./contracts.mjs";
 
 function safe(value) {
   const raw = String(value ?? "未提供");
   // Hide the whole field: token-by-token replacement leaks the tail of a path
   // containing spaces and can turn a multi-line log into apparently safe prose.
   if (
-    /[\x00-\x1f\x7f\u202a-\u202e\u2066-\u2069]/.test(raw) ||
+    terminalText(raw) !== raw ||
     /(?:[a-z]:[\\/]|\\\\|~[\\/]|(?:^|[\s("'`=：:，；])\/|\.\.[\\/]|\/[^\s/]+\/)/i.test(
       raw,
     ) ||

package/kernel/lib/patch-mounts.mjs

@@ -0,0 +1,232 @@
+/** Bounded, non-evaluating subset of DSH's ordered bundle patch composition.
+ * Unsupported expressions/aliases and cross-bundle targets limit coverage.
+ * Only insert rows (and known group descendants) introduce module roots.
+ */
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parseDocument, isAlias, isMap, isSeq, isPair } from "yaml";
+import { inputError } from "./static-input.mjs";
+
+export function patchMounts(files, { root, read, check, note, limits }) {
+  const rows = [],
+    index = new Map(),
+    bases = new WeakMap(),
+    assertionNames = new WeakMap();
+  let nodes = 0,
+    complete = true;
+  const uncertain = (file, message) => {
+    complete = false;
+    note("patch-resolution-uncertain", file, message);
+  };
+  const invalid = (message) => {
+    throw new Error(message);
+  };
+  const inspect = (root) => {
+    const queue = [[root, 0]];
+    while (queue.length) {
+      check();
+      const [node, depth] = queue.pop();
+      if (!node || typeof node !== "object") continue;
+      if (++nodes > limits.yamlNodes || depth > limits.yamlDepth)
+        throw inputError(
+          "STATIC_INPUT_BUDGET",
+          "Patch node/depth budget exceeded",
+        );
+      // Zero alias expansion: anchors alone are harmless, aliases are explicit
+      // unsupported input. No cyclic graph or expansion reaches composition.
+      if (isAlias(node))
+        invalid("Patch aliases are unsupported (expansion budget 0)");
+      if (isMap(node) || isSeq(node))
+        for (const item of node.items) queue.push([item, depth + 1]);
+      else if (isPair(node)) {
+        queue.push([node.key, depth + 1], [node.value, depth + 1]);
+      }
+    }
+  };
+  const rowList = (entries, base) => {
+    if (!Array.isArray(entries))
+      invalid("Patch insert/group config must be a literal row list");
+    for (const row of entries) {
+      if (!(row instanceof Map)) invalid("Patch row must be a literal mapping");
+      for (const key of ["group", "disabled"])
+        if (
+          row.has(key) &&
+          row.get(key) !== null &&
+          typeof row.get(key) !== "boolean"
+        )
+          invalid("Patch row flags must be literal booleans");
+      if (typeof row.get("name") !== "string" || !row.get("name"))
+        invalid("Patch row name is unavailable");
+      if (row.has("id") && typeof row.get("id") !== "string")
+        invalid("Patch row id must be a string");
+      bases.set(row, base);
+      const name = row.get("name");
+      assertionNames.set(
+        row,
+        path.isAbsolute(name) || name.startsWith("./") || name.startsWith("../")
+          ? pathToFileURL(path.resolve(root, base, name)).href
+          : name,
+      );
+      const id = row.get("id");
+      if (id) {
+        if (index.has(id)) invalid("Duplicate patch row id is ambiguous");
+        index.set(id, row);
+      }
+      if (row.get("group") && Array.isArray(row.get("config")))
+        rowList(row.get("config"), base);
+    }
+    return entries;
+  };
+  for (let i = 0; i < files.length; i++) {
+    const file = files[i];
+    try {
+      check();
+      if (i >= limits.yamlFiles)
+        throw inputError(
+          "STATIC_INPUT_BUDGET",
+          "Patch file count budget exceeded",
+        );
+      const doc = parseDocument(read(file), {
+        uniqueKeys: true,
+        schema: "core",
+      });
+      check();
+      if (doc.errors.length || doc.warnings.length)
+        invalid("Invalid or unsupported patch YAML");
+      inspect(doc.contents);
+      const patches = doc.toJS({ mapAsMap: true, maxAliasCount: 0 });
+      if (!Array.isArray(patches)) invalid("Patch must be a top-level list");
+      for (const patch of patches) {
+        check();
+        if (!(patch instanceof Map))
+          invalid("Patch operation must be a mapping");
+        const id = patch.get("id"),
+          insert = patch.get("insert");
+        if (patch.has("insert")) {
+          const target = id ? index.get(id) : null;
+          if (id && (!target || !target.get("group"))) {
+            uncertain(file, "Insert target is unavailable or not a group");
+            continue;
+          }
+          const added = rowList(insert, path.dirname(file));
+          if (target) {
+            if (!Array.isArray(target.get("config"))) target.set("config", []);
+            target.get("config").push(...added);
+          } else rows.push(...added);
+          continue;
+        }
+        const target = id && index.get(id);
+        if (!target) {
+          uncertain(
+            file,
+            "Override target is unavailable; name is an assertion, not a mount",
+          );
+          continue;
+        }
+        if (
+          patch.get("name") &&
+          patch.get("name") !== assertionNames.get(target)
+        ) {
+          uncertain(file, "Override name assertion did not match");
+          continue;
+        }
+        for (const [key, value] of patch) {
+          if (["id", "name"].includes(key)) continue;
+          if (
+            ["group", "disabled"].includes(key) &&
+            value !== null &&
+            typeof value !== "boolean"
+          )
+            invalid("Dynamic patch flags cannot establish mounts");
+          target.set(key, value);
+        }
+        // Like the host, config replacements do not reindex new child ids.
+        // Relative paths in such replacements use the profile tree, not the
+        // patch file's base, so they must not be guessed package-relative.
+      }
+    } catch (error) {
+      complete = false;
+      note(
+        error.code === "STATIC_INPUT_BUDGET"
+          ? "scan-budget-exceeded"
+          : "patch-unreadable",
+        file,
+        error.message,
+      );
+      return { mounts: [], complete: false };
+    }
+  }
+  const mounts = [];
+  const walk = (entries, disabled = false) => {
+    for (const row of entries) {
+      check();
+      if (!(row instanceof Map)) {
+        uncertain(null, "Group replacement contains an invalid row");
+        continue;
+      }
+      const name = row.get("name"),
+        group = row.get("group") === true;
+      if (
+        ["group", "disabled"].some(
+          (key) =>
+            row.has(key) &&
+            row.get(key) !== null &&
+            typeof row.get(key) !== "boolean",
+        )
+      ) {
+        uncertain(null, "Replacement row flags are not literal booleans");
+        continue;
+      }
+      const blocked = disabled || row.get("disabled") === true;
+      if (!group && blocked) continue;
+      if (typeof name !== "string") {
+        uncertain(null, "Group replacement name is unavailable");
+        continue;
+      }
+      if (name === "cordis:group" && group) {
+        const children = row.get("config");
+        if (!Array.isArray(children))
+          uncertain(null, "Group config is not a literal row list");
+        else walk(children, blocked);
+      } else if (name.startsWith("cordis:")) {
+        uncertain(null, "Builtin subtree semantics are not established");
+      } else {
+        if (path.isAbsolute(name)) mounts.push(name);
+        else if (name.startsWith("file://")) {
+          try {
+            const url = new URL(name);
+            if (url.search || url.hash)
+              throw Error("URL modifiers are not established");
+            mounts.push(fileURLToPath(url));
+          } catch {
+            uncertain(null, "File URL mount is not established");
+          }
+        } else if (name.startsWith("./") || name.startsWith("../")) {
+          if (!bases.has(row))
+            uncertain(
+              null,
+              "Relative replacement row depends on the profile base",
+            );
+          else mounts.push("./" + path.join(bases.get(row), name));
+        } else if (name.startsWith("."))
+          uncertain(null, "Relative mount depends on the profile base");
+        else mounts.push(name);
+        if (group)
+          uncertain(null, "Custom group descendants are not established");
+      }
+    }
+  };
+  try {
+    walk(rows);
+  } catch (error) {
+    note(
+      error.code === "STATIC_INPUT_BUDGET"
+        ? "scan-budget-exceeded"
+        : "patch-unreadable",
+      null,
+      error.message,
+    );
+    return { mounts: [], complete: false };
+  }
+  return { mounts, complete };
+}

package/kernel/lib/report-identity-worker.mjs

@@ -2,13 +2,40 @@ import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { parentPort, workerData } from "node:worker_threads";
+import {
+  readStaticDirectory,
+  readStaticFile,
+  lowerInputLimits,
+} from "./static-input.mjs";
+const limits = lowerInputLimits(
+  {
+    entries: 50000,
+    files: 50000,
+    directories: 10000,
+    bytes: 32 * 1024 * 1024,
+    timeMs: 5000,
+  },
+  workerData.limits,
+);
+const started = Date.now();
+const check = () => {
+  if (Date.now() - started > limits.timeMs) throw Error("缓存身份时间预算超限");
+};
+let entries = 0,
+  bytesRead = 0;
+const list = (dir) => {
+  const names = readStaticDirectory(dir, limits.entries - entries, check);
+  entries += names.length;
+  return names;
+};
 const hash = createHash("sha256");
 const add = (value) => hash.update(JSON.stringify(value) + "\n");
-let remaining = 50000,
-  directories = 10000;
+let remaining = limits.files,
+  directories = limits.directories;
 const services = new Set(),
   manifests = [];
 function metadata(file) {
+  check();
   if (--remaining < 0) throw Error("缓存身份文件预算超限，等待后续刷新");
   const stat = fs.statSync(file);
   add([
@@ -23,32 +50,29 @@ function metadata(file) {
   return stat;
 }
 function smallFile(file, limit = 1024 * 1024) {
-  let fd;
   try {
     metadata(file);
-    // Open nonblocking before inspecting the same descriptor. A swapped
-    // symlink or FIFO cannot turn the following bounded read into a host hang.
-    fd = fs.openSync(
-      file,
-      fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0),
-    );
-    const stat = fs.fstatSync(fd);
-    if (!stat.isFile() || stat.size > limit)
-      throw Error("缓存身份输入不是预算内普通文件");
-    const buffer = Buffer.alloc(limit + 1),
-      length = fs.readSync(fd, buffer, 0, buffer.length, 0);
-    if (length > limit) throw Error("缓存身份输入超过读取预算");
-    const bytes = buffer.subarray(0, length);
+    let bytes;
+    try {
+      bytes = readStaticFile(
+        file,
+        Math.min(limit, limits.bytes - bytesRead),
+        check,
+      );
+    } catch (error) {
+      if (error.code === "STATIC_INPUT_TYPE")
+        throw Error("缓存身份输入不是预算内普通文件");
+      throw error;
+    }
+    bytesRead += bytes.length;
     add(bytes.toString("base64"));
     return bytes;
   } catch (error) {
-    if (error.code === "ENOENT" || error.code === "ENOTDIR") {
+    if (["ENOENT", "ENOTDIR"].includes(error.code)) {
       add([file, "missing"]);
       return null;
     }
     throw error;
-  } finally {
-    if (fd !== undefined) fs.closeSync(fd);
   }
 }
 
@@ -66,7 +90,7 @@ function walk(root) {
     )
       continue;
     seen.add(real);
-    for (const entry of fs.readdirSync(dir).sort()) {
+    for (const entry of list(dir)) {
       const file = path.join(dir, entry);
       let stat;
       try {
@@ -86,12 +110,9 @@ try {
   const { nodeModules, files = [], context = {} } = workerData;
   add(context);
   metadata(nodeModules);
-  for (const name of fs.readdirSync(nodeModules).sort()) {
+  for (const name of list(nodeModules)) {
     const bases = name.startsWith("@")
-      ? fs
-          .readdirSync(path.join(nodeModules, name))
-          .sort()
-          .map((n) => path.join(name, n))
+      ? list(path.join(nodeModules, name)).map((n) => path.join(name, n))
       : [name];
     for (const base of bases) {
       const root = path.join(nodeModules, base);
@@ -99,7 +120,7 @@ try {
       try {
         bytes = smallFile(path.join(root, "package.json"), 65536);
       } catch (error) {
-        if (remaining < 0) throw error;
+        if (remaining < 0 || error.code === "STATIC_INPUT_BUDGET") throw error;
         add([root, "unreadable-manifest", error.code || error.message]);
         continue;
       }

package/kernel/lib/report-identity.mjs

@@ -1,11 +1,12 @@
-import { runWorkerTask } from "./worker-analysis.mjs";
+import { runReportWorkerTask } from "./worker-analysis.mjs";
 /** Bounded metadata walk runs off the host thread and never imports plugin code. */
-export function reportIdentity(inputs) {
-  return runWorkerTask(
+export function reportIdentity(inputs, { signal } = {}) {
+  return runReportWorkerTask(
     new URL("./report-identity-worker.mjs", import.meta.url),
     inputs,
     {
       timeoutMs: 5000,
+      signal,
       resourceLimits: {
         maxOldGenerationSizeMb: 128,
         maxYoungGenerationSizeMb: 16,